How do I install the Network Ntlm Relay skill?

Run npx skillmds@latest add noorqureshi/network-ntlm-relay in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Network Ntlm Relay safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Network Ntlm Relay?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Network Ntlm Relay free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Network Ntlm Relay?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Network Ntlm Relay by noorqureshi — Agent Skill

Name: Network Ntlm Relay
Author: NoorQureshi

Network Ntlm Relay

Coerce and relay NTLM authentication for lateral movement and privilege escalation (relay to SMB, LDAP, ADCS). Load in an AD network with a foothold, on "NTLM relay", "responder", "coerce", no/absent SMB signing, or PetitPotam/PrinterBug. Signals: LLMNR/NBT-NS traffic, SMB signing off, MS-RPRN/EFSRPC.

NoorQureshi Updated Sep 17, 2026

File contents

NTLM coercion & relay

When it applies

You're on an AD network (unauthenticated or with a foothold) and want to move laterally or escalate without cracking passwords. If SMB signing isn't enforced (or you target LDAP/ADCS), you can relay a victim's NTLM authentication to a service and act as them.

Why it works

NTLM authentication isn't bound to the channel: if you can make a machine/user authenticate to you (coercion or poisoning), you forward that authentication to another service. Without signing (SMB) or channel binding (LDAP/HTTP), the target accepts it, and you get access as the coerced identity — often a computer account with local admin elsewhere, or a DC to ADCS.

Method

Get victims to authenticate to you:
- Poisoning: responder -I eth0 answers LLMNR/NBT-NS/mDNS for mistyped names → captures/relays auth.
- Coercion: force a specific machine (esp. a DC) to auth to you — coercer, PetitPotam (MS-EFSRPC), PrinterBug (MS-RPRN), dfscoerce.
Find relay targets: hosts with SMB signing not required (nxc smb <range> --gen-relay-list), or LDAP/LDAPS on DCs, or the ADCS web enrollment endpoint.
Relay: impacket-ntlmrelayx -tf targets.txt -smb2support (SMB), -t ldaps://DC (LDAP — e.g. grant RBCD or DCSync), or -t http://CA/certsrv/certfnsh.asp --adcs (ESC8 → cert for a DC → DA, chain with ad-adcs).
Escalate: relayed to LDAP → set RBCD on a computer you control → impersonate DA on it; relayed to ADCS → auth as the DC.

Gotchas

Turn off Responder's SMB/HTTP servers when using ntlmrelayx (port conflict).
SMB signing required blocks SMB relay — pivot to LDAP/ADCS relay instead.
Coercing a DC + ADCS ESC8 is the reliable domain-takeover combo; PetitPotam often works unauthenticated.

Verify success

Access/action as the relayed identity — a session/command on a target host, RBCD set, a cert issued for a DC, or hashes dumped — demonstrating relay-based movement/escalation.

References

impacket ntlmrelayx; SpecterOps relay research; PetitPotam/Coercer; "Certified Pre-Owned" (ESC8).

---name: network-ntlm-relaydescription: Coerce and relay NTLM authentication for lateral movement and privilege escalation (relay to SMB, LDAP, ADCS). Load in an AD network with a foothold, on "NTLM relay", "responder", "coerce", no/absent SMB signing, or PetitPotam/PrinterBug. Signals: LLMNR/NBT-NS traffic, SMB signing off, MS-RPRN/EFSRPC.---# NTLM coercion & relay## When it appliesYou're on an AD network (unauthenticated or with a foothold) and want to move laterally or escalatewithout cracking passwords. If SMB signing isn't enforced (or you target LDAP/ADCS), you can relaya victim's NTLM authentication to a service and act as them.## Why it worksNTLM authentication isn't bound to the channel: if you can make a machine/user authenticate to *you*(coercion or poisoning), you forward that authentication to another service. Without signing(SMB) or channel binding (LDAP/HTTP), the target accepts it, and you get access as the coerced identity —often a computer account with local admin elsewhere, or a DC to ADCS.## Method1. **Get victims to authenticate to you**: - **Poisoning**: `responder -I eth0` answers LLMNR/NBT-NS/mDNS for mistyped names → captures/relays auth. - **Coercion**: force a specific machine (esp. a DC) to auth to you — `coercer`, `PetitPotam` (MS-EFSRPC), PrinterBug (MS-RPRN), `dfscoerce`.2. **Find relay targets**: hosts with **SMB signing not required** (`nxc smb <range> --gen-relay-list`), or LDAP/LDAPS on DCs, or the ADCS web enrollment endpoint.3. **Relay**: `impacket-ntlmrelayx -tf targets.txt -smb2support` (SMB), `-t ldaps://DC` (LDAP — e.g. grant RBCD or DCSync), or `-t http://CA/certsrv/certfnsh.asp --adcs` (**ESC8** → cert for a DC → DA, chain with `ad-adcs`).4. **Escalate**: relayed to LDAP → set **RBCD** on a computer you control → impersonate DA on it; relayed to ADCS → auth as the DC.## Gotchas- Turn off Responder's SMB/HTTP servers when using ntlmrelayx (port conflict).- SMB signing **required** blocks SMB relay — pivot to LDAP/ADCS relay instead.- Coercing a DC + ADCS ESC8 is the reliable domain-takeover combo; PetitPotam often works unauthenticated.## Verify successAccess/action as the relayed identity — a session/command on a target host, RBCD set, a cert issuedfor a DC, or hashes dumped — demonstrating relay-based movement/escalation.## Referencesimpacket ntlmrelayx; SpecterOps relay research; PetitPotam/Coercer; "Certified Pre-Owned" (ESC8).

Frequently asked questions